Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Wagtail allows unauthorized page translations

CVE-2026-54262 · published 4 months ago
Summary

In older versions of the Wagtail content system, a user with only the "Can submit translation" right could create translated copies of any page, even those they were not allowed to edit. This could let low‑level staff make changes to content they shouldn't access. Upgrade to the latest Wagtail release to ensure translation rights respect existing page permissions.

What to do
  • Update wagtail core team + contributors wagtail to version 7.0.8.
  • Update wagtail core team + contributors wagtail to version 7.3.3.
  • Update wagtail core team + contributors wagtail to version 7.4.2.
Affected software
Ecosystem VendorProductAffected versions
pip wagtail core team + contributors wagtail < 7.0.8
>= 7.1, < 7.3.3
>= 7.4, < 7.4.2
Fix: upgrade to 7.0.8
– torchbox wagtail < 7.0.8
>= 7.1, < 7.3.3
>= 7.4, < 7.4.2
cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:*
Original advisory text
Wagtail: Pages translations can be created without page permissions when using simple_translation
Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, a low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-280Improper Handling of Insufficient Permissions or Privileges
Timeline
Published1 Jul 2026
Updated3 Nov 2026
First seen1 Jul 2026
Sources
CVE-2026-54262 · NVD
GHSA-8634-mr4j-r72c · GHSA
CVE-2026-54262 · OSV
Track software like this
Free during beta